CREATE LOGIN POLICY policy-name policy-options

policy options :
policy-option [ policy-option ... ]

policy-option :
policy-option-name = policy-option-value

policy-option-value : 
{ UNLIMITED | legal-option-value }

If you do not specify a policy option, values for this login policy are taken from the root login policy. New policies do not inherit the MAX_NON_DBA_CONNECTIONS and ROOT_AUTO_UNLOCK_TIME policy options.

All new databases include a root login policy. You can modify the root login policy values, but you cannot delete the policy. An overview of the default values for the root login policy is provided in the table above.

You must have the MANAGE ANY LOGIN POLICY system privilege.

None.

• ALTER LOGIN POLICY statement
• ALTER USER statement
• COMMENT statement
• CREATE USER statement
• DROP LOGIN POLICY statement
• DROP USER statement
• Login policies
• Creating a new login policy
• Assigning a login policy to an existing user

The following example creates the Test1 login policy. This example has an unlimited password life and allows the user a maximum of 5 attempts to enter a correct password before the account is locked.

CREATE LOGIN POLICY Test1 
PASSWORD_LIFE_TIME=UNLIMITED
MAX_FAILED_LOGIN_ATTEMPTS=5;

The following example shows typical settings for a new login policy (ldap_user_policy) that uses LDAP user authentication. Both a primary and a secondary server configuration object (which would have been previously created) are specified to allow failover to the secondary LDAP server, and the ability to failover to standard authentication is allowed when system resources, network resources, or, both primary and secondary LDAP servers are unresponsive. This example provides a combination of authentication options that permits responsiveness with cached values when an LDAP server cannot keep up with incoming requests. This example assumes that the login_mode database option includes 'Standard'. You cannot paste and run this example, since the primary and secondary servers mentioned in the example are fictitious.

CREATE LOGIN POLICY ldap_user_policy  
LDAP_PRIMARY_SERVER=ldapsrv1 
LDAP_SECONDARY_SERVER=ldapsrv2
LDAP_FAILOVER_TO_STD=ON;